Skip to main content

​
Overview

A scope is one permission on one resource, named resource:action, and a role bundles scopes. You assign a role to a user or a group either organization-wide or for a single workspace, and Tracecat computes each user’s effective permissions from those assignments.

​
Built-in roles

Tracecat seeds six built-in roles into every organization at startup. Tracecat rejects changes to a built-in role’s scopes and rejects deleting it, so create a custom role when the built-in set does not fit. The Scopes column counts the current definition. Startup seeding adds scopes a built-in role is missing and removes none, so an organization created before a scope was renamed also keeps the old name. organization-owner and organization-admin reach every workspace in the organization without a workspace membership. Every other user needs a workspace membership plus a workspace role, and organization-member on its own grants no workspace resource scope. Built-in roles

​
Assignments

An assignment binds one role to one user or one group, either organization-wide or for a single workspace. An organization-wide assignment applies in every workspace, and a workspace assignment grants nothing outside that workspace. A user’s effective scopes are the union of their direct assignments and the assignments of every group they belong to. A user with workspace-viewer directly and a group assignment of workspace-editor in the same workspace holds every workspace-editor scope there. Each user holds at most one direct assignment per workspace and at most one organization-wide direct assignment, and the same limit applies to each group. Tracecat refuses a second assignment for the same user and workspace with User already has an assignment for this workspace, and for the same group with Group already has an assignment for this workspace — change the role on the existing assignment instead. You can assign a role only when you hold every scope in it, and platform superusers are exempt from this rule. Tracecat refuses an assignment whose role carries a scope you lack, or adding a user to a group whose roles carry one, with Cannot grant scopes not held by the caller. You change a member’s role on the workspace Members page at /workspaces/{id}/members, which writes a workspace-scoped user assignment for that member. Without the rbac_addons entitlement you manage access with built-in roles from the organization Members page and the workspace Members page. See Custom roles and groups for custom roles, groups, and scopes.

​
Organization membership

A role assignment applies only to a user who is a member of the organization, and Tracecat rejects assigning a role or a group to a user without membership with User not found in organization. A signed-in user without an organization membership sees No organization access yet instead of their workspaces, with any pending invitations listed. Registration and sign-in without an invitation create no membership. On a single-tenant deployment, registration or sign-in enrolls a superuser into the default organization and repairs the organization-wide role of an existing member. An account that holds no membership needs an invitation or provisioning before it can open a workspace. An accepted organization invitation creates the membership and an organization-wide assignment of the invited role. An accepted workspace invitation creates the organization membership with organization-member when the user has none, then the workspace membership. See User management for invitations.
  • See User management for registration, invitations, and organization membership.
  • See Custom roles and groups for custom roles, groups, custom scopes, and assignment management on the Access control page.
  • See Service accounts for machine identities that hold scopes directly, with no role.
  • See Architecture for how RBAC fits the identity and trust model.
  • See Organization audit logs for the rbac_role, rbac_group, rbac_assignment, and rbac_user_assignment events.